Phantom: When running a Splunk action why the error "Failed to acquire lock"?

[apollo_sj]

Hi All,

We are running an Splunk action - run query (search) on a Phantom playbook which is active on every event coming on to phantom. However, at times the action - run query (search) fails with message: Failed to acquire lock named '08' for Action: 'run query', App: 'Splunk'. Failed to acquire the lock '08'. The action - run query (search) tries to execute for 30 minutes or so and eventually fails. Any help to troubleshoot this issue is highly appreciated.

Thanks in advance 🙂

[JH_1234]

I had this issue today, and I had to go back through my phantom events, and there was a run query that had been running for 24 hours. I'm not sure why it didn't time out, but find when your error started happening and look at the phantom event right before it and see if there is an action that is stuck in a running state and terminate it.